feat(phase0): configure ArgoCD SOPS decryption + update encrypted secrets

Phase 0 continuation: enable ArgoCD to decrypt SOPS-encrypted secrets on sync.

1. Update ArgoCD Helm values (terraform/argocd-bootstrap.tf):
   - Add SOPS_AGE_KEY_FILE env var to repoServer
   - Mount sops-age K8s Secret at /home/argocd/.sops
   - Add ConfigManagementPlugin for SOPS (detects *.enc.yaml files)

2. Update encrypted secrets with real values:
   - k8s/base/secrets.enc.yaml: encrypted with actual service credentials
   - All secret values encrypted at rest in git
   - ArgoCD decrypts on sync using K8s Secret + AGE key

Prerequisites:
  - K8s Secret created: kubectl create secret generic sops-age -n argocd --from-file=keys.txt=/Users/rockliang/.sops/key.txt
  - SOPS_AGE_KEY_FILE env var set in ArgoCD repoServer (done above)

Next: Phase 1 — migrate 9 hookless releases to ArgoCD + create Applications that reference encrypted secrets.

k8s/base/secrets.enc.yaml

@@ -1,40 +1,38 @@
-#ENC[AES256_GCM,data:k1a5oCIROHB42A03dwKG3cCui4iOr2YQ1S2BydD8/KZFwAaGZ+0=,iv:bOu/4lsBjwWeNueNT5IoKqxnxUsD08wqrnMj3PbO6ZA=,tag:KxqqstEoZek5iIl77vU9BA==,type:comment]
-#ENC[AES256_GCM,data:kcyifte8jC2RIxTAEhd739OPeDE/cN9HgLsvoXkYvrCI1RTct91aFMVhvAsdV3WmFQhIsaKm41m4XuMYX4s/A/eSrobtkHJcsGFDBYtycw==,iv:rojwVUquM7W40bZzDRT1ZR3nh/Q78CsWPGgA7dA5+Tc=,tag:3dL7o5GoioD4YGG4uwl/9w==,type:comment]
 authentik:
-    secret_key: ENC[AES256_GCM,data:OC4O2uQU9ZSIlpzXbaRkQy7f6bVeFKEXzEv0EeqfN00=,iv:OlLZz/7hF2DrajC6HH5wCd99/tZmyeCs2Bhy6Tsa5YU=,tag:e6o5KIChJp9P9arpzIVq0A==,type:str]
-    bootstrap_password: ENC[AES256_GCM,data:d8ssYA2Qrza5R01b9jTE8siqy1Xhkom9xaHaCHbZ,iv:owp4nlv5fElzNIQ07yZSpWtsdSWKnLfdubOisDKdnJI=,tag:Z6rOQqa1iThjQEyAGvUqog==,type:str]
-    bootstrap_token: ENC[AES256_GCM,data:SZIjtiybSqk5TZCK7tknEsGeE165K7eDS40T,iv:/rF97yp3MxZn1nlw3xuN7oW/3+F5/xOkUlV5rrxVozY=,tag:Q3vkjaZatKemV7PjV77Duw==,type:str]
-    postgresql_password: ENC[AES256_GCM,data:myRIPmkEXnBNoK0IvD+BhkZo9FFNo/D3rvX06x/+5ozR,iv:MzmgyfKhug4KssBDaKzddhQCK2kfCIY1jey8sDt1oMU=,tag:AyQw/lJNvJcO5MACpaivog==,type:str]
+    secret_key: ENC[AES256_GCM,data:4u/VJKGJL6J+ILh2+HY=,iv:mZus6YQX7TK6BK8JbHvS113ph4jZpUqKiKLK69nLc8k=,tag:xj/FhXl/GpA7zfYBkyEpGA==,type:str]
+    bootstrap_password: ENC[AES256_GCM,data:z5qyj124j90pimo07QQ=,iv:oJj54T0WEoy4zq8gTPsCBEZ5BqJubbyuLBdb9in98oU=,tag:SaVmxgIqxhzBjOnMi1PT6g==,type:str]
+    bootstrap_token: ENC[AES256_GCM,data:zbs67SwmNqXUj1inerg=,iv:TL3hu2NR9eCvZQHM9L2WJHlhi1lqNJDU+tKHJHy8OZM=,tag:2fzVZDXazzNrExBq/12dfQ==,type:str]
+    postgresql_password: ENC[AES256_GCM,data:lnisFWkVkv9LmRiB+cA=,iv:nFcecdugM8GB+ty4Ac5HhN84ekWk+VpDRh2QuW7cZhk=,tag:8Nu9aodwPqQ+1OP4xRVr2g==,type:str]
 minio:
-    root_user: ENC[AES256_GCM,data:+EQ2wuGD1kkzwA==,iv:wuj5wnW9Snv23KrrGM6gJALFXCj8JDgkFC757j8sQ4E=,tag:+GxxIgtIe1tVLKooyK2zGg==,type:str]
-    root_password: ENC[AES256_GCM,data:Nk2F+G1GC9t9HVZm+UltRRXTCptb6P3oegw=,iv:9HtWDrb2i5CuWAIKy1tTqam1nLkpylTTx+jg8we+tOQ=,tag:kJ/6zXw1dr8qZeVu18qMMA==,type:str]
-    oidc_client_secret: ENC[AES256_GCM,data:nekH14JGIL6Cp5WRlr5DLgIRZZHpy8zW6972lIs=,iv:7b4GeRUi0dD8HJ5NVcfYoW26V+xlTH03pFxfwS8Fdk0=,tag:+A+sIOBJCmGgGBLKyVYR8Q==,type:str]
+    root_user: ENC[AES256_GCM,data:MQQHIaoc1tuG8A==,iv:92bGTYwyqc7tasjO0F8j2cBH28/ZOBHMkawsix6Z0UE=,tag:gkug3OeiZ5tpPrtXApFfsg==,type:str]
+    root_password: ENC[AES256_GCM,data:Neb1t95cJqxnnXKCIAYqLl6N0zdtD843RrnHyXhnEulZhvqPeMC2Y1DIZr8=,iv:NSveFwxhONWq8MfcVCvjLisbHJgZfkLBBp9Z0tmxQ+Y=,tag:zM0hpg97GcMJ9YFtDj7vjQ==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:I+JJuokOMYX/52sSxos=,iv:wxZQ1NaeYCF3EMkZKyrzTXP35fbiA8VnMZV3cX+NYuA=,tag:O/7kuLTws7cz45GbACHsYQ==,type:str]
 forgejo:
-    admin_password: ENC[AES256_GCM,data:yV31S6LtztoRShZ7Sy/p5HMHsXKD82emFp4D5g==,iv:yznI8H6a8gOAl334aSFtwBBjv8K5B5hxKA7u7ZIwX48=,tag:MLef9OHXbXcxtIutr4t+Tw==,type:str]
-    oidc_client_secret: ENC[AES256_GCM,data:md3A65MtGRtth6rotRgUiLiP1L4wuA7F5MD7rdxHdw==,iv:DFRa32Dy1Jp5l0BNoPSbNbYRwo2KY38UIgWdpCRjm9k=,tag:qwMAJ0JMhhvmTlw6SFebPg==,type:str]
+    admin_password: ENC[AES256_GCM,data:WbjwEpB6vkRjZEwXg1QVPVl0pj5/QOfuo0SJndBr5OE=,iv:jvZ7+IH++qaUJL9Ts2+6X5ip1QvLOeGfzoBsKsFjbwo=,tag:zQXfRuXUdqwTcA7EDzRwJA==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:2ikhULuCiUx98G9FubTKolZrDLuctA6F7m7xSTK/K+qHAmN4Zuqi+BzU56dfC0W2g7ZUqQ8flPQ8Jw2HlR/mww==,iv:zVZeAdxraSEQNMSX1r08L8j5g7pCKP86OTOBAHg3AIU=,tag:vke5Pj7QnEPIbI6LswLXnQ==,type:str]
 grafana:
-    admin_password: ENC[AES256_GCM,data:r3V6owuFGH1FciXbPXBX0stEkrXQ4J+QpA9nUA==,iv:d+IpwYe2Jtxb3RI0qkMClTKLVmDHfyu1ismG9ZG+l3w=,tag:s5HBtXq6zBMOqlV5egNeeQ==,type:str]
-    oidc_client_secret: ENC[AES256_GCM,data:ne/YcY1wsLYFFrELfaA5kgGNeSb+Fb3/s9NAqAtRXA==,iv:3m3BLCNarhIPHIrCJX7YpER+JiTxnI91lmjpQh837AU=,tag:OVVRxGfLloCfIA0PbBjYog==,type:str]
+    admin_password: ENC[AES256_GCM,data:cFfbO8f/A2yQVnXUa2Trpnp9g6M=,iv:LEnAOBFwr4YtmlXdE+GnorFPR1zJ406sxch0pgnnTCs=,tag:LDkt62m8zIw6sBTIiJBLTA==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:YQV8mM6ogq57bXb1oFCocO+JPhFztAhqosex54s4ZcvJDSnQbAy/ILfcTVqQ26qoD4M7Bf2p+P/lSAO9RXPKtA==,iv:X2X/k2MqdEXN0SO53RadvS3JKzkXlTfgSf5bZCaWFRI=,tag:UK+BvSBa2ZXLmZHoh/V18A==,type:str]
 argocd:
-    oidc_client_secret: ENC[AES256_GCM,data:kS3WCF0NGWWYeQjo8M5p8vu6FKTozLdR437dnn+D,iv:kLRlwiur1YWLgGc2UFwPp/5+GUmNX8finanLPAAqhD4=,tag:N/cV8xGrh/99d2MGpEk/Mg==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:BxTd8J/hnMDRBwND1ho=,iv:hP8OwLWTiaB3tT5kQarDWpfPYe/wWP/7DP+TyM7OJZY=,tag:K05rRDyk6dJYAtjJmgtbNQ==,type:str]
 temporal:
-    oidc_client_id: ENC[AES256_GCM,data:1uz28SF6Vitn3VB4J9wOb0ggFr27TrJpgGELow==,iv:7xTD3Z3843UYCGxnvoZ2tDWOs4CjbF5P5fxIg9SyOm4=,tag:NSm+3jim+HNRkn5slAunJw==,type:str]
-    oidc_client_secret: ENC[AES256_GCM,data:gNWGxyniP3FI58YdLh55LqDbUxwUHH+1hvnioxRB9ys=,iv:WpfOAw6C3wIeNEYT+kOjRKfKEdP6tMZziFAzdTov4Uo=,tag:Tnfl5/ggsmWdDndKNibuJw==,type:str]
+    oidc_client_id: ENC[AES256_GCM,data:zKj5POhCGcfoXy+d+zg=,iv:1NmLIy0xQ9V9AZipU/r6HQOPkvsTFV29cESVFsRZaZw=,tag:U+SkYLAXj5OSNJImINO5sw==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:hWgK6dhh7onHmTwq3UU=,iv:iahP7vl3RPQaOJDvlTVqjn1+w8H8y0AZ/CToiIpZtB4=,tag:qqRhHShIc36aEmtUHHUnig==,type:str]
 ollama:
-    oidc_client_id: ENC[AES256_GCM,data:8lXuGFkPwnOI9uNA9cbNh92q+vIZSZR8hNU=,iv:rMZtnwyYS1bvovKQDO/FO3xZItgXiopOnY8ab4ApBso=,tag:Rx6tniX2i+leCzr5c52yxA==,type:str]
-    oidc_client_secret: ENC[AES256_GCM,data:ssYURrGZ+7jbKUfoNLxyrOXR1Ee9QXfUpBlAHjYi,iv:bhlVSQFF+Xza9WzBQUlmhWs33zi6nmUprZ5txP9kWtw=,tag:FNPfUdXNh5b10oz5IYRWSg==,type:str]
+    oidc_client_id: ENC[AES256_GCM,data:b9+dTdLSL4mbodLBcI8=,iv:gnborzVMME6Baw4LuvucjdqjNnyygXhRZ1K4yQyr26c=,tag:2DfC9uRbVKzf5zcPspa+vA==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:Ow8JrhgCJlHfYfQ1GBc=,iv:QBXdVyowDKPsN4Fjbe9Eh0O4cTgrPAx6EfN5kpRRsek=,tag:zw4mN/SJQMh25vm/yoCNBQ==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbEhGbHJEbktxSmVIRjF6
-            Z2JFb3pjMWg2elBhVEV3UmVGTit0V29TTW1JCkptVkUvTnkxaGJnaTI1RHh4d0R0
-            TXY1QVBVOUFvc0dvUjBhZHhIT0k0dncKLS0tIG0yZEVLK01wMGx0bHNRckpUT3c1
-            TzZORWdzK3ZvOFJhRC9KWW1Gbmc2SzAK0GXC78gW8MrPEpZEgYPTxmXs8MOeNz8E
-            LqHuHHTDBl7m4IOwkuKhqvzR1+DJ8FeMEyzdF5OE61wkAes/758ZlQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVWZkRDRBc09BakYvaUZD
+            em1CcFhwOVpjRnJsYjhxM3J3WldnMjE3MkJvClJrT1BXaGFkOU80V3krbVRNYXVo
+            RE5Jb0dISEJiU1lVc1U4blI0b2d6SVUKLS0tIDM2dk95M08rQkNuYStYbks1ZVBG
+            L2pIS3ZMYUVxTndwcW1zNCtPbWJ0Y2sKW6SkSLf+y37WR0hVy5bVegnsjBRCsmqq
+            VYNVFf/xzrCU6Bjv0KV/1laHHmQoea1xQPC2l6KrptUEZoVjDYkKpQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T21:59:44Z"
-    mac: ENC[AES256_GCM,data:VeRGqVo6KVNkFTkeuOeeYdpOz6Pjf/ndqF4RjDsS73kW+gh7Q1O7dbuGWxJquhG/jTamZQa8XkMk0NA0KtAuyqxbM7sWXbKV4bk3hDYGOk/AZ6XEo4sjivvqLiYctaZQ0DHQ7v6Q1tB5BBvN2wVs7ueh4T/HsEVT3aFGH2iTlTg=,iv:UP1LRRVzZD+aYr/mlZjHcyIXSDW/4p3b6UdB20A6uIY=,tag:QO7Jdz4L56AqheAYcvJcjw==,type:str]
+    lastmodified: "2026-07-15T22:03:57Z"
+    mac: ENC[AES256_GCM,data:wds9Tc4t3V5uTxdsXtJuuOXLfRNt+uPso6Ge3TTgv8BDDxN/jPQmBPljvdKp8U7kXhtq7ifgtEbJUwunZvBAhJN8T2gQs6+SaNgNS+H7RqWXWsTnMy0u1PAz6WX8FEYNeZMqePrkAtV6kLjx3B/b6bL+mRxVXut8+kBmfpKgoEI=,iv:Su6uHqqn5qdoIdxxOGRmapyv8OsYNbPwRVD/QHgJZa0=,tag:hh9KcYDXPaq+aGUDzJDPKQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

terraform/argocd-bootstrap.tf

@@ -43,6 +43,22 @@ resource "helm_release" "argocd" {
         rbac = {
           "policy.default" = "role:readonly"
         }
+        cmp = {
+          create = true
+          plugins = {
+            sops = {
+              allowConcurrency = false
+              discover = {
+                fileName = "*.enc.yaml"
+              }
+              generate = {
+                command = ["sh", "-c"]
+                args = ["sops -d \"$ARGOCD_ENV_FILE_PATH\""]
+              }
+              lockRepo = false
+            }
+          }
+        }
       }
       server = {
         extraArgs = [
@@ -73,6 +89,10 @@ resource "helm_release" "argocd" {
             name  = "GIT_SSL_CAINFO"
             value = "/etc/ssl/certs/homelab-ca.crt"
           }
+          {
+            name  = "SOPS_AGE_KEY_FILE"
+            value = "/home/argocd/.sops/keys.txt"
+          }
         ]
         volumes = [
           {
@@ -81,6 +101,13 @@ resource "helm_release" "argocd" {
               secretName = "homelab-ca-secret"
             }
           }
+          {
+            name = "sops-age"
+            secret = {
+              secretName = "sops-age"
+              defaultMode = 384
+            }
+          }
         ]
         volumeMounts = [
           {
@@ -88,6 +115,11 @@ resource "helm_release" "argocd" {
             mountPath = "/etc/ssl/certs/homelab-ca.crt"
             subPath   = "tls.crt"
           }
+          {
+            name      = "sops-age"
+            mountPath = "/home/argocd/.sops"
+            readOnly  = true
+          }
         ]
       }
       controller = {